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Stefan Matthews [smatthews @sterling.ph] 


Sent: 1/20/2016 8:00:56 AM 

To: nCrypt Craig [craig@ncrypt.com] 

cc: nCrypt Ramona [ramona@ncrypt.com]; Robert MacGregor [rmacgregor@tyche.co.uk] 
Subject: Re: Legal Privilege 


Quite a bit of this will not fall within the scope of the warrant anyways. 


From: nCrypt Craig <craig@ncrypt.com> 
Sent: Wednesday, January 20, 2016 6:58 PM 
To: Stefan Matthews 

Ce: nCrypt Ramona; Robert MacGregor 
Subject: Re: Legal Privilege 


Yes. 
it was all copied. The drives were to be wiped leaving the only copies with me, but now there are two. 


Oh well, by the time they know it will be out in any event. 
On Wed, Jan 20, 2016 at 7:38 AM, Stefan Matthews <smatthews@sterling.ph> wrote: 
_ They will be lucky to have been able to analyse the data by May, let alone understand it in any meaningful 


way. 


In terms of "Things that help prove my involvement in bitcoin to at least 2009" | am assuming there is a 
duplicate of this someplace else? 





From: nCrypt Craig <craig@ncrypt.com> 

Sent: Wednesday, January 20, 2016 6:34 PM 

To: Stefan Matthews 

Ce: nCrypt Ramona; Robert MacGregor 

Subject: Re: Legal Privilege 

Not in a criminal sense as they are trying to fish for. 

Things that help prove my involvement in bitcoin to at least 2009. 


Things we do not want them to know, but things that will come out by April / May. 


On Wed, Jan 20, 2016 at 7:32 AM, Stefan Matthews <smatthews@sterling.ph> wrote: 
So nothing of a detrimental nature? 


Sent from my iPhone 
On 20 Jan 2016, at 3:30 PM, nCrypt Craig <craig@ncrypt.com> wrote: 
The drives have: 


e Systems and research (most of it} 
e Experimental data 
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« Early comms with Dave and Hal 

« There are key files and passwords, but nothing that now matters - | have changed all 
of them 

e Panama access keys for the VPN (that is now revoked) 

e University material from my Risk studies and teaching 

e Alot of encrypted data 


Craig 


On Wed, Jan 20, 2016 at 4:48 AM, Stefan Matthews <smatthews@sterling.ph> wrote: 
Craig, what exactly was on those HDDs that were located at Gordon, the 47 seized from 
Excess Technology ? 








From: Metin Ozmen <metin @laxonlex.com.au> 
Sent: Wednesday, January 20, 2016 3:44 PM 
To: John Laxon; nCrypt Craig; nCrypt Ramona; Stefan Matthews 


Ce: john@bliwilp.com 
Subject: RE: Legal Privilege 


| Dear Craig, Ramona & Stefan, 


Further to John’s email | called the ATO digital forensics technicians involved in the data recovery and 
: hard-ware interrogation. The Chief analyst Graeme Walker confirmed the following: 


1) in relation to the material stored on DeMorgan servers (‘Server Material’). There have been 
unexpected ‘data processing errors’. The data has been mirrored onto ATO machines and must be 
reformatted before it can be worked on. Processing may begin next week when Investigators confirm 
the agreed search terms as provided by Laxon Lex today. 

2) ‘Rack space’ cloud data was accessed through the DeMorgan servers at the time of the warrant 
execution (‘cloud data’). Approximately 162,000 emails have been accessed. Processing will be 
conducted when Investigators confirm the agreed search terms as provided by Laxon Lex today and 
may occur prior to the searches of the ‘server material’. 

3) 47 separate Hard Drives are currently held by forensics as seized from ‘Excess Technology’ 
(‘Excess Technology data’). Approximately 7% of the data on some of the HD's was wiped by Excess 
Technology. All data will need to be identified / restored / reinstalled before the HD's can be 
reconfigured to work in concert. Walker’s analogy was at this stage / will need to repeatedly win 
consecutive Powerball’s in order to retrieve anything. 


Regards, 


Metin Ozmen 


CONFIDENTIAL DEF_01895778 


Case 9:18-cv-80176-BB Document 829-77 Entered on FLSD Docket 12/16/2021 Page 3 of 8 


Solicitor 
d +6102 9339 2906 m 0474 121979 e metin@laxoniex.com.au 
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The contents of this email (including any attachments) are privileged and confidential and for use by the intended recipient only. If you receive this 
email in error, please notify the sender and delete the email immediately. 


From: John Laxon 
Sent: Wednesday, 20 January 2016 12:41 PM 
To: nCrypt Craig <craig@ncrypt.com>; nCrypt Rarnona <ramona@ncrypt.com>; Stefan Matthews 


<smatthews @sterling.ph> 
Ce: Metin Ozmen <metin@laxonlex.com.au>; john@blwilp.com 


_ Subject: RE: Legal Privilege 
_ importance: High 


Dear Craig, Ramona & Stefan, 
Metin and i met with Russell Mann and Stewart Parrott from the ATO this morning. 


Mann is the Manager of criminal investigations for private groups and high wealth individuals, - 
according to his card. Both men made it clear that their involvement is only in respect of the criminal 
investigation, not the tax side of things. 


in his stated attempts to be up front, Mann advised that the ATO had obtained business records from 
the Administrators of Hotwire, McGrath Nicol. He said there was some conjecture as to whether a 
server had been provided to the Administrator, as had been requested of Craig. 


He asked whether we wished to include the documents obtained by the ATO from the Administrator 
in our claim for LPP once they were ready and | advised that we did. This was noted and agreed. 
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Secondly, he said that ATO were aware that 1-2 days before the search warrants were executed, a 
business called Excess Technology from Smithfield had come to your home and removed 8 or 9 
servers to delete information and resell the servers. 


The ATO became aware of that and executed a search warrant at Excess Technologies premises in 
Smithfield on 17/12/15 and material was obtained, including business records of various companies 
associated with you. At the time of the search the deletion of the material on the servers was 
underway but was only 5-10% complete. There had been a power outage which had delayed the 
process. 


Mann advised that the material cannot yet be read, as the devices need to be re-configured ina 
certain way to make accessing the information possible and the forensics people are presently trying 
to figure that out. Once they have done so.. and there is a list of the information available, we will 
again be given the opportunity of reviewing the material for the purpose of making any LPP 

claims. Mark Gomez from the ATO will call me once this material is ready to be accessed. 


i asked how the ATO became aware of the involvement of Excess Technology — | asked did you have 
| telephone intercepts or listening devices? He said that he could not tell us how they became aware 
other than there were no LD or Tl warrants and who knows, perhaps we received a tip off from an 

: employee. | have no idea of the veracity of this statement. 


| Mann advised that Excess Technology had also removed servers from Delhi Rd some weeks prior to 
_ the search, the wiping of which had been completed by the time of the search and there was nothing 
left for the ATO to retrieve. 


i advised that once Forensics had completed their search of the electronic material taken from Delhi 
Rd, given the massive volume of material there was no way possible that 14 days would be enough 
time for us to review the material and make LPP claims. Both men readily agreed and accepted that 
a more reasonable time frame could well be 3-6 months, possibly longer, depending upon what we 
end up being given. 


Finally Mann asked if | knew where you were and | said that | did not, other than that | understood 
you were overseas. He said he wants to formally offer you the chance to take part in a recorded 
interview. | said | would pass that on, but that | anticipated you would not be wanting to take hirn up 
on that offer. He understood that was probably the case, but that if it would help, they were happy 
to travel to you. 
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i told hirn | didn’t doubt that, although | did not expect my instructions would change in that 
regard. it may be obvious but for the avoidance of doubt, | advise against taking part in a voluntary 
recorded interview with the ATO or police. 


Regards, 


John Laxon 


d +61 02 9339 2902 m 0414 657 696 @ john @laxonlex.com.au 
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The contents of this email (including any attachments) are privileged and confidential and for use by the intended recipient only. If you receive this 
' email in error, please notify the sender and delete the email immediately. 


From: nCrypt Craig [mailto:craig@ncrypt.com] 
Sent: Monday, 18 January 2016 3:02 AM 

To: nCrypt Ramona; Stefan Matthews; John Laxon 
Subject: Legal Privilege 





Hi John, 


The data on the cloud was accessed by our IT support technician being asked (and hence 
providing) all the passwords to everything that he had. Allan Pedersen lodged a complaint 
against the treatment of Nick (the IT technician ) - apparently he was pushed around and 
harassed, and Nick had a fainting fit from stress. Allan tells me he received a call from the 
AFP the following day with an apology of sorts. 


The data on the cloud were from all our historical emails that were not accessible on 
site. The warrant did not request that. Your email above states: 
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"So if during the search of the premises a computer was operated from which data was 
accessed from the cloud, which was relevant evidential material, then the AFP/ATO would 
argue that it was evidence lawfully obtained..." 


None of the computers that were on site accessed data from the cloud - it was simply that 
the IT technician had the password and was coerced into giving it to the AFP. Hence, can 
you say that this was legally obtained? Much of what they obtained from the cloud do not 
support the keywords on the warrant - yet they could be used against us as they have access 
to other material. For eg, there were backup emails on the cloud relating to the forensic 
experts reports that were not sent through you. in some instances the forensic experts 
emailed me directly. This will not be privileged information but could be harmful to our 
case. This is only one example. Please advise on this. 


in terms of LLP, the relevant lawyers were: 


® timothy.edwards@mk.com.au 





@® MK 


® M+K Lawyers 


@ Shehadie 


® Michael Shehadie 


Mitchie Shehadie & Co 


® Clayton Utz 


o Andrew Sommer 


o Nicholas Mavrakis 


o Jennifer Ball 


o There are many others 


Do we list each CU solicitor in turn? 


@ Stephen D’Emilio 


o Fong D'Emilio Lawyers 


o sdemilio@fdlaw.com.au 





© stephend@mk.com.au 
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o Adrian Fong 
® Richard Steele (barister} 
@ Heydon Miller (Barister} 

o hdmiller 

© level22.com.au 
@ Lloyds 


@ Lloyds Solicitors 


® Dianne Pinder 

® McCabe 

@ McCabe Tyrrells Solicitors 
@ McCabes 

@ Andrew Lacey 

@ Davies Collison Cave 
Grant Stonier 


| All the many I? lawyers. 





The following are a law firm: 


ighsecured.com/legal-services.ph 





® Signia 


@ High Secured. 


We used their legal services through Signia. 


We aiso have all the UK lawyers. 


Craig 
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